Analysis
- max time kernel
2s - max time network
119s - platform
windows10_x64 - resource
win10v20201028 - submitted
15/11/2020, 22:59
Static task
static1
Behavioral task
behavioral1
Sample
10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
- Size 2.9MB
- Sample201115-399pl5xpr2
- SHA256 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6
- MD5 a5ac324a441a5b9911fb2b8010d96f7e
- SHA1 44720945197795ddc50ece473deed81cc331b9a8
- SHA512 144358eb81c0de7b2b0b9d7a66528639bc72f69462d87381debe73d9cf40b77446607b1820ca637da4051a34ef9da24e2f1f8aa5ff41c2b513b67fac93c2c2c2
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4644 set thread context of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4644 wrote to memory of 5000 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 73 PID 4644 wrote to memory of 5000 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 73 PID 4644 wrote to memory of 5000 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 73 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77 PID 4644 wrote to memory of 3400 4644 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe"C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:5000
-
-
C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exeC:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe2⤵PID:3400
-